thodg/libgit2/src

Diff

  • Show log

    Commit

  • Hash : 7cc80546
    Author : Patrick Steinhardt
    Date : 2018-01-03T12:54:42 

    streams: openssl: fix thread-safety for OpenSSL error messages

The function `ERR_error_string` can be invoked without providing a
buffer, in which case OpenSSL will simply return a string printed into a
static buffer. Obviously and as documented in ERR_error_string(3), this
is not thread-safe at all. As libgit2 is a library, though, it is easily
possible that other threads may be using OpenSSL at the same time, which
might lead to clobbered error strings.

Fix the issue by instead using a stack-allocated buffer. According to
the documentation, the caller has to provide a buffer of at least 256
bytes of size. While we do so, make sure that the buffer will never get
overflown by switching to `ERR_error_string_n` to specify the buffer's
size.

kmx.io     mail     discord kmxgit v0.4.0